assembly - 指令解码器如何区分 32 位模式下的 EVEX 前缀和 BOUND 操作码？

Question

在32位模式下，Intel通过反转寄存器扩展的高位来解决VEX前缀与LDS/LES冲突，因为ModRM字节的mod字段不能为11b

The VEX prefix's initial-byte values, C4h and C5h, are the same as the opcodes of the LDS and LES instructions. These instructions are not supported in 64-bit mode. To resolve the ambiguity while in 32-bit mode, VEX's specification exploits the fact that a legal LDS or LES's ModRM byte can not be of the form 11xxxxxx (which would specify a register operand). Various bit-fields in the VEX prefix's second byte are inverted to ensure that the byte is always of this form in 32-bit mode.

https://en.wikipedia.org/wiki/VEX_prefix#Technical_description

但是，在 EVEX 中，R 和 X 位并未反转，这导致 mod=00b，这也表示 BOUND 指令中的内存操作数

Four bits R, X, B, and W from the REX prefix. W expands the operand size to 64 bits or serves as an additional opcode, R expands reg, B expands r/m or reg, and X and B expand index and base in the SIB byte. Comparing to the VEX prefix, RXB are provided in non-inversed forms, just like in the REX prefix.

https://en.wikipedia.org/wiki/EVEX_prefix

那么他们如何才能干净地解码该指令重叠呢？

<小时/>

我查了Intel手册，他们似乎只提到了VEX中的位反转，但没有提到EVEX。

OTOH sandpile 中的表表示 EVEX 中的 RXB 位也应该反转。

哪一个是正确的？

Answer 1

反转位的技巧之所以有效，是因为有两个事实:

1. 在 32 位模式下，32 个 ZMM 寄存器中只有 8 个可用，因此 EVEX.R' 位永远不会翻转，因此永远不会与允许的 BOUND 编码产生别名。
2. 在 64 位模式下，无法识别 BOUND 指令，因此 EVEX 位可以采用任何值。

摘自 patent AVX 澄清了这一点:

[0111] REX′ field —this is the first part of the REX′ field and is the EVEX.R′ bit field (EVEX Byte 1, bit [4]—R′) that is used to encode either the upper 16 or lower 16 of the extended 32 register set. In one embodiment of the invention, this bit, along with others as indicated below, is stored in bit inverted format to distinguish (in the well-known x86 32-bit mode) from the BOUND instruction, whose real opcode byte is 62, but does not accept in the MOD R/M field (described below) the value of 11 in the MOD field; alternative embodiments of the invention do not store this and the other indicated bits below in the inverted format. A value of 1 is used to encode the lower 16 registers. In other words, R′Rrrr is formed by combining EVEX.R′, EVEX.R, and the other RRR from other fields.

但是，Intel SDM尚不清楚这一事实。我浏览了SDM，确实，在EVEX部分中没有提及EVEX编码的补码含义的痕迹。人们必须以某种方式从 EVEX 是 VEX 的扩展这一事实中推断出它，而对于后者，有一个反向含义的陈述(第 2A 卷，第 2.3.5 节，第一个项目符号):

This field is encoded using 1’s complement form (inverted form), i.e. XMM0/YMM0/R0 is encoded as 1111B, XMM15/YMM15/R15 is encoded as 0000B.